Fuzzing In The Year 2000

Summary: Trail of Bits reproduced the 2000 NT Fuzz Report by Forrester and Miller, running the original fuzzer against 28 applications on 64-bit Windows 10 Pro version 1809 and finding that 93% still crash or freeze on malformed window messages, versus 100% of 33 applications in 2000. Only Calculator and Avast Antivirus survived, and the team also found a non-security crash in wow64win.dll triggered by WM_DEVICECHANGE in 32-bit applications, which MSRC confirmed is not a security issue.
Key Takeaway: Nineteen years after the original research, the simplest possible window message fuzzer still takes down 93% of tested applications, which the authors treat as a measure of software robustness and quality rather than a vulnerability count. The two survivors show that handling malformed input is achievable, so the gap is institutional rather than technical.

Read the original at Trail of Bits Blog ↗